diff --git a/README.md b/README.md
index d6af23e..595b79d 100644
--- a/README.md
+++ b/README.md
@@ -172,6 +172,7 @@ Day-to-day you'll use the shipped shortcuts instead:
 ```sh
 sys-update    # nix flake update + system rebuild (BTRFS snapshot first when available)
 sys-rebuild   # system rebuild against the CURRENT lock (config changes only, no update)
+              # …both end with a package-level diff of what the rebuild changed (nvd)
 home-update   # home-manager switch (no flake update, no sudo)
 ```
 
diff --git a/agent/BACKLOG.md b/agent/BACKLOG.md
index eff3146..140ae37 100644
--- a/agent/BACKLOG.md
+++ b/agent/BACKLOG.md
@@ -28,15 +28,15 @@ next, in what order*.
 
 ### 9. Update & rollback UX
 New; extends the update-awareness story to the other half: what changed,
-and how do I get back. (a) `sys-update` prints a human diff of what the
-update changed (`nvd diff` between system generations, or `nix store
-diff-closures`); (b) a **System → Rollback** menu flow: desktop = pick a
-recent `home-manager generations` entry and activate it (the theme
-history is already generations); system = point at the boot-menu
-generation flow + `nomarchy-snapshots` rather than reimplementing it —
-destructive steps keep the typed-`yes` gate. **Why:** informative +
-rock-stable means undo is one menu away, not a Nix lesson. **Verify:**
-V1; V2 for the generation-activate path in a VM.
+and how do I get back. Done: (a) `sys-update` AND `sys-rebuild` end with
+an `nvd diff` of old→new generation (store-path-pinned; never fails the
+run; "no changes" fast-path). Remaining: (b) a **System → Rollback**
+menu flow: desktop = pick a recent `home-manager generations` entry and
+activate it (the theme history is already generations); system = point
+at the boot-menu generation flow + `nomarchy-snapshots` rather than
+reimplementing it — destructive steps keep the typed-`yes` gate.
+**Why:** informative + rock-stable means undo is one menu away, not a
+Nix lesson. **Verify:** V1; V2 for the generation-activate path in a VM.
 
 ### 10. `nomarchy-doctor` — one-shot health check
 New. A single command (+ System-menu entry) that checks the things that
diff --git a/agent/JOURNAL.md b/agent/JOURNAL.md
index 546f432..4707959 100644
--- a/agent/JOURNAL.md
+++ b/agent/JOURNAL.md
@@ -17,6 +17,22 @@ Template:
 
 ---
 
+## 2026-07-04 — sys-update/-rebuild what-changed diff (iteration #18, item 9a)
+- **Task:** BACKLOG NEXT#9 half (a) — a human diff after system rebuilds.
+- **Did:** both sys-update and sys-rebuild (twins stay twins) capture
+  /run/current-system before, and after the switch print
+  `nvd diff before after` (store-path-pinned ${"$"}{pkgs.nvd}, `|| true`
+  so it can't fail a succeeded rebuild; identical-path fast-path says
+  "no changes"). README §3 shortcut block notes it.
+- **Verified:** V0; V1 — template-system toplevel rebuilt, generated
+  scripts extracted + bash -n, nvd smoke-run against the real closure
+  (correct output format). Runtime behaviour is a trivial shell path —
+  no VM needed.
+- **Pending:** half (b) — the System → Rollback menu flow (desktop
+  generations picker; system → boot menu + snapshots pointer).
+- **Next suggestion:** item 9b — it completes the item; V2 the
+  generation-activate path.
+
 ## 2026-07-04 — viewers + mime defaults (iteration #17, item 8)
 - **Task:** BACKLOG NEXT#8 — PDF/image viewers + xdg-mime defaults.
 - **Did:** modules/home/viewers.nix (`nomarchy.viewers.enable`, default
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index c9488ca..5897c10 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -307,11 +307,22 @@ in
         flake="''${NOMARCHY_PATH:-$HOME/.nomarchy}"
         echo "sys-update: updating flake inputs in $flake"
         nix flake update --flake "$flake"
+        before=$(readlink -f /run/current-system)
         if command -v nixos-rebuild-snap >/dev/null 2>&1; then
           sudo nixos-rebuild-snap "$@"   # BTRFS snapshot first
         else
           sudo nixos-rebuild switch --flake "$flake#default" "$@"
         fi
+        # What did that update actually change? Package-level diff of the
+        # old vs new generation (the informative half of "informative +
+        # rock-stable"); never fails the run.
+        after=$(readlink -f /run/current-system)
+        if [ "$before" = "$after" ]; then
+          echo "sys-update: no changes — the system is identical."
+        else
+          echo "sys-update: what changed:"
+          ${pkgs.nvd}/bin/nvd diff "$before" "$after" || true
+        fi
       '')
       # The no-update twin (hardware-QA request): rebuild the system
       # against the CURRENT lock — config changes only, no `nix flake
@@ -324,11 +335,20 @@ in
           exit 1
         fi
         flake="''${NOMARCHY_PATH:-$HOME/.nomarchy}"
+        before=$(readlink -f /run/current-system)
         if command -v nixos-rebuild-snap >/dev/null 2>&1; then
           sudo nixos-rebuild-snap "$@"   # BTRFS snapshot first
         else
           sudo nixos-rebuild switch --flake "$flake#default" "$@"
         fi
+        # Same what-changed diff as sys-update (the twins stay twins).
+        after=$(readlink -f /run/current-system)
+        if [ "$before" = "$after" ]; then
+          echo "sys-rebuild: no changes — the system is identical."
+        else
+          echo "sys-rebuild: what changed:"
+          ${pkgs.nvd}/bin/nvd diff "$before" "$after" || true
+        fi
       '')
       (pkgs.writeShellScriptBin "home-update" ''
         set -e